ASD Essentials for Enterprise IT RES-04: Incident insight: post-incident reviews of the gaps that enabled each stage, and evaluation of monitoring and response procedures

What does RES-04 require?

After an incident the organisation reviews which security gaps let each stage of the attack succeed, and re-evaluates both its monitoring coverage and its response procedures in that light.

Maintained by Gerard Blokdyk

Other controls in Capability domain: Visibility and response – ASD Essentials for Enterprise IT

DET-01 Centralised event logging: protected central log storage, forwarded high-value logs and configuration changes
DET-02 Cyber security event detection: detection logic for unauthorised change, anomalous authentication and suspicious execution on normalised, time-synchronised, enriched logs
DET-03 Incident identification: timely triage against incident thresholds using correlated indicators
DET-05 Detection capability efficacy: review coverage periodically for gaps from new assets, services and architecture changes
IDE-01 Asset identification: automated discovery inventory and current records of infrastructure, software, identities, credentials and data
IDE-04 Security risk identification: use weaknesses, adversary techniques and threat behaviours in risk assessments and review them continuously
RES-03 Incident response: use documented, tested and approved procedures
RES-05 Incident coordination: integrate external coordination obligations into response

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ASD Essentials for Enterprise IT controls